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Re: Application of: 
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International 
Application No. 
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Ulrich HEISTER 
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DEVICE AND METHOD FOR SYNCHRONIZING 
VOLTAGE CIPHERING MACHINE IN ATM 
NETWORKS 



BOX PCT 

Asst. Commissioner for Patents 
Washington, D.C. 20231 

July 17, 2001 



PRELIMINARY AMENDMENT 

Sir: 

Applicants request that the following Amendments be made in the above-identified 
matter prior to examination thereof: 



IN THE TITLE 

Please amend the title to read as follows: -DEVICE AND METHOD FOR 
SYNCHRONIZING STREAM ENCRYPTORS IN ATM NETWORKS--. 



IN THE SPECIFICATION 

Before paragraph [0001], please change the heading "Specification" to - Field of the 
Invention —. 

Before paragraph [0002], please insert the heading: - Related Technology -. 
Before paragraph [0007], please insert heading: - Summary of the Invention -. 
Please amend paragraph [0007] to read as follows: 



[0007] An object of the present invention is to provide a reliable method for synchronizing 
stream decryptors which does not require additional capacity and can be implemented with a 
small outlay. 

Please amend paragraph [0008] to read as follows: 
[0008] The present invention allocates a state automaton to the stream encryptor and to the at 
least one stream decryptor, respectively, it being possible for the state automaton to be advanced 
from ATM cell to ATM cell, and the respective state, besides the secret key, being used for 
generating the variable key. 

Please amend paragraph [0009] to read as follows: 
[0009] In this context, provision can be made for the state to be able to be fed to a device for 
generating a function as a function of the state and of the secret key, the device being designed 
for controlling the pseudo-random generator. 

Please amend paragraph [001 1] to read as follows: 
[001 1] In an embodiment according to the present invention, in the stream encryptor, the secret 
key of the destination of the specific transmitted ATM cell and the respective state are used for 
generating the variable key, and the state automatons of the stream encryptor and of the stream 
decryptors can be advanced independently of the destination of the specific ATM cell. In this 
context, each ONT (optical network termination) has a secret key, the OLT (optical line 
termination) has the secret keys of all ONTs. 

Please amend paragraph [0012] to read as follows: 
[0012] In the method according to the present invention the variable key depends, moreover, on 
the state of a state automaton which is allocated to the stream encryptor and to the at least one 
stream decryptor and which is advanced from ATM cell to ATM cell. In this context, provision 
may be made for the advance of the state automaton to be derived in response to the detection of 
a cell boundary by comparing a check sequence computed from the header to a check sequence 
which is also transmitted in the header of the cell. This does not involve any additional outlay 
because devices for cell boundary detection are needed in the receivers anyway. 

Please amend paragraph [0013] to read as follows: 



[0013] In an embodiment of the method according to the present invention an input variable for 
the respective pseudo-random generator is generated from the secret key and the respective state 
with the aid of a predefined function. 

Please amend paragraph [0014] to read as follows: 
[0014] The method according to the present invention may be advantageously applied where 
several receivers which each have a stream decryptor are connected to the transmission channel, 
and, in this connection, headers of the ATM cells contain information on which receivers are the 
destinations of the ATM cells, because the secret key of the stream decryptor at the respective 
destination is taken as the basis for generating the variable key in the stream encryptor and 
because the state automatons allocated to the stream encryptor and to the stream decryptors are 
advanced in response to each transmitted ATM cell. 

Before paragraph [0015], please insert the heading: 
--Brief Description of the Drawings--. 

Please amend paragraph [0015] to read as follows: 
[0015] Exemplary embodiments of the present invention are elaborated upon below with 
reference to the drawings, in which: 

Please amend paragraph [0016] to read as follows: 
[0016] Figure 1 shows a schematic representation of an ATM network including a 
transmitter and two receivers; and 

Figure 2 shows a schematic representation of a prior art method for cell boundary 
detection. 

Before paragraph [0017], please insert the heading: — Detailed Description— . 

Please amend paragraph [0018] to read as follows: 
[0018] A prior art device for cell boundary detection is schematically shown in Fig. 2; 40 bits 
being tapped in each case from the cell stream supplied via 2 (in the Figure, one arrow represents 
4 bits). Via bits 9 through 40, a HEC is generated at 13 in the same manner as in the transmitter, 
the HEC being compared to the preceding bits 1 through 8 in an 8-bit comparator 14. In the case 
of equality, a signal is emitted at 15 which signifies the detection of a valid header, staggered by 
a certain angular value between adjacent intermediate walls 6 to prevent a continuous electric arc 
in the current-limiting event. 



Page 6, first line, please change : "What is claimed is" to -WHAT IS CLAIMED IS--. 



IN THE CLAIMS : 

Please cancel claims 1-7 as presented in the underlying International Application No. 
PCT/EP99/09844, as well as the revised claims 1-3 annexed to the International Preliminary 
Examination Report (a translation of which claims is submitted herewith), and add new claims 8- 
14 as follows: 

—8. (new) An apparatus for synchronizing at least one stream decryptor connected to a 
transmission channel for ATM cells at a receiver end, a stream encryptor being disposed in the 
transmission channel at a transmitter end, the device comprising: 

a first pseudo-random generator associated with the stream encryptor for generating a 
respective first variable key associated with each of the at least one stream decryptor using a 
respective secret key associated with each of the at least one stream decryptor; 

a respective second pseudo-random generator associated each of the at least one stream 
decryptor for generating a respective second variable key using the respective secret key, each of 
the respective second variable key being identical to the associated respective first variable key; 

a respective device for cell boundary detection associated with each of the at least one 
stream decryptor; and 

a respective state automaton associated with the stream encryptor and each of the at least 
one stream decryptor, a respective state of each respective state automaton associated with the at 
least one stream decryptor being capable of being advanced by the respective device for cell 
boundary detection, each of the respective states being used for generating the respective variable 
key. 

9. (new) The apparatus as recited in claim 8 wherein the respective state of each state 
automaton is capable of being fed to a respective "device for generating a predefined function 
using the respective state and the respective secret key, each of the device for generating a 
predefined function being capable of controlling the respective pseudo-random generator. 



10. (new) The apparatus as recited in claim 8 wherein the at least one stream decryptor 
includes a plurality of stream decryptors, a respective receiver being associated with each of the 
plurality of stream decryptors, each of the receivers being connected to the transmission channel, 
a respective header of each of the ATM cells including respective information identifying a 
respective destination receiver of the receivers; 

wherein the stream encryptor is capable of generating the respective first variable key 
using the respective secret key associated with the respective destination receiver of a respective 
transmitted ATM cell and the respective state; and 

wherein each of the state automatons are capable of being advanced independently of the 
respective destination receiver. 

1 1 . (new) A method for synchronizing at least one stream decryptor connected to a 
transmission channel for ATM cells at a receiver end, a stream encryptor being disposed in the 
transmission channel at a transmitter end, the method comprising: 

generating a respective first variable key associated with each of the at least one stream 
decryptor using a respective secret key associated with each of the at least one stream decryptor 
and a first pseudo-random generator associated with the stream encryptor; 

generating a respective second variable key associated with each of the at least one 
stream decryptor using the respective secret key and a respective second pseudo-random 
generator associated with the respective stream decryptor, each respective second variable key 
being identical the respective first variable key; and 

advancing on a per- ATM cell basis a respective state of a respective state automaton 
associated with the stream encryptor and each of the at least one stream decryptor, each of the 
first and second variable keys being a function of the respective state. 

12. (new) The method as recited in claim 1 1 wherein the advancing of the respective state 
associated with each of the at least one stream decryptor is performed in response to a detecting 
of a respective ATM cell boundary, the detecting being performed by comparing a check 
sequence computed from a respective header of the ATM cell to a check sequence transmitted in 
the header. 



13. (new) The method as recited in claim 1 1 further comprising generating a respective 
input variable for each of the pseudo-random generator using the respective secret key, the 
respective state, and a respective predefined function. 

14. (new) The method as recited in claim 1 1 wherein the at least one stream decryptor 
includes a plurality of stream decryptors, a respective receiver being associated with each of the 
plurality of stream decryptors, each of the receivers being connected to the transmission channel, 
a respective header of each of the ATM cells including respective information identifying a 
respective destination receiver of the receivers; 

generating each of the first and second variable keys using the respective secret key of the 
respective stream decryptor associated with each of the destination receivers; and 

advancing the respective state of each of the state automatons in response to a 
transmission of an ATM cell-. 

IN THE ABSTRACT : 

Please replace the Abstract of record with the following new Abstract: 

-A device and a method for synchronizing at least one stream decryptor connected to a 
transmission channel for ATM cells at the receiver end, with a stream encryptor arranged in the 
transmission channel at the transmitter end. The stream encryptor and each stream decryptor 
each have a pseudo-random generator which generates a variable key which is identical at the 
transmitter and at the receiver end. The stream decryptor(s) are each allocated a device for cell 
boundary detection. The stream encryptor and the stream decryptor(s) are each allocated a state 
automaton, it being possible for the state automaton(s) of the stream decryptors to be advanced 
by the respective devices for cell boundary detection. The respective state and the respective 
secret key are used for generating the variable key.-. 

REMARKS 



Consideration of this application, as amended, is respectfully requested. 



Support for all new claims is found in the specification as originally filed. It is 
respectfully submitted that no new matter has been added. 

Applicants believe that no fees are due as a result of this amendment. In the event of a 
fee discrepancy, please charge our Deposit Account No. 50-0552. 



Davidson, Davidson & Kappel, LLC 
485 Seventh Avenue - 14 th Floor 
New York, New York 10018 
(212) 736-1940 



"Express Mail" mailing label no. EL 825523305 US 
Date of deposit- July 17, 2001 

I hereby certify that this correspondence and/or fee is being 
deposited with the United States Postal Service "Express Mail 
Post Office to Addressee" service under 37 CFR 1.10 on the 
date indicated above in an envelope addressed to "Commissioner 
of Patents and Trademarks, Washington, DC 20231" 




DAVIDSON, DAVIDSON & KAPPEL, LLC 



Application of: Ulrich Heister 

International Application No. PCT/EP99/09844 

Filed Herewith 



VERSION OF SPECIFICATION AND CLAIMS AMENDMENTS 
WITH MARKINGS TO SHOW CHANGES MADE 

IN THE TITLE: 

DEVICE AND METHOD FOR SYNCHRONIZING STREAM ENCRYPTORS [VOLTAGE 
CIPHERING MACHINE] IN ATM NETWORKS 

IN THE SPECIFICATION: 

Page 1, before paragraph [0001]: [Specification] Field of the Invention . 
Page 1, before paragraph [0002]: -- Related Technology -. 
Page 2, before paragraph [0007]: - Summary of the Invention -. 
Page 2, paragraph [0007]: 

[0007] [The] An object of the present invention is to [specify] provide a reliable method for 
synchronizing stream decryptors which does not require additional capacity and can be 
implemented with [the smallest possible] a small outlay. 

Page 2, paragraph [0008]: 

[0008] [In the device according to the present invention, this object is achieved by allocating] 
The present invention allocates a state automaton to the stream encryptor and to the at least one 
stream decryptor, respectively, it being possible for the state automaton to be advanced from 
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ATM cell to ATM cell, and the respective state, besides the secret key, being used for generating 
the variable key. 

Page 2, paragraph [0009]: 

[0009] In this context, provision can be made [in a preferred embodiment] for the state to be able 
to be fed to a device for generating a function as a function of the state and of the secret key, the 
device being designed for controlling the pseudo-random generator. 

Page 3, paragraph [0011]: 

[001 1] [The device according to the present invention can, in principle, be already used in the 
case of a transmission between a transmitter and a receiver. However, a particularly 
advantageous further refinement consists in that] In an embodiment accord ing to the present 
invention, in the stream encryptor, the secret key of the destination of the specific transmitted 
ATM cell and the respective state are used for generating the variable key, and [in that] the state 
automatons of the stream encryptor and of the stream decryptors can be advanced independently 
of the destination of the specific ATM cell In this context, each ONT (optical network 
termination) has a secret key, the OLT (optical line termination) has the secret keys of all ONTs. 

Page 3, paragraph [0012]: 

[0012] [The objective is achieved in] In the method according to the present invention [in that] 
the variable key depends, moreover, on the state of a state automaton which is allocated to the 
stream encryptor and to the at least one stream decryptor and which is advanced from ATM cell 
to ATM cell In this context, provision [is preferably] maybe made for the advance of the state 
automaton to be derived in response to the detection of a cell boundary by comparing a check 
sequence computed from the header to a check sequence which is also transmitted in the header 
of the cell. This does not involve any additional outlay because devices for cell boundary 
detection are needed in the receivers anyway. 



Page 3, paragraph [0013]: 



[0013] [An advantageous] In an embodiment of the method according to the present invention 
[consists in that] an input variable for the respective pseudo-random generator is generated from 
the secret key and the respective state with the aid of a predefined function. 

Page 3, paragraph [0014]: 

[0014] The method according to the present invention [is] may be [particularly advantageous] 
advantageously applied [if] where several receivers which each have a stream decryptor are 
connected to the transmission channel, and, in this connection, headers of the ATM cells contain 
information on which receivers are the destinations of the ATM cells, because the secret key of 
the stream decryptor at the respective destination is taken as the basis for generating the variable 
key in the stream encryptor and because the state automatons allocated to the stream encryptor 
and to the stream decryptors are advanced in response to each transmitted ATM cell 

Page 4, before paragraph [0015]: --Brief Description of the Drawings-. 

Page 4, paragraph [0015]: 

[0015] Exemplary embodiments of the present invention are [shown in the drawing on the basis 
of several Figures and explained in greater detail in the following description] elaborated upon 
below with reference to the drawings, in which: . 

Page 4, paragraph [0016]: 

[0016] Figure 1 shows a [detail] schematic representation of an ATM network including a 
transmitter and two receivers; and 
Figure 2 shows a schematic representation of a prior art method for cell boundary 
detection [which is known per se]. 

Page 4, before paragraph [0017]: - Detailed Description-- . 

Page 4, paragraph [0018]: 
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[0018] A prior art device for cell boundary detection is schematically shown in Fig. 2; 40 bits 
being tapped in each case from the cell stream supplied via 2 (in the Figure, one arrow represents 
4 bits). Via bits 9 through 40, a HEC is generated at 13 in the same manner as in the transmitter, 
the HEC being compared to the preceding bits 1 through 8 in an 8-bit comparator 14. Lei the case 
of equality, a signal is emitted at 15 which signifies the detection of a valid header, staggered by 
a certain angular value between adjacent intermediate walls 6 to prevent a continuous electric arc 
in the current-limiting event. 

Page 6 first line : -WHAT IS CLAIMED IS~[ Whatis claimed is l. 
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DEVICE AND METHOD FOR SYNCHRONISING VOLTAGE CIPHERING MACHINE 

IN ATM NETWORKS 

Specification 

[0001] The present invention relates to a device and a method for synchronizing at least one 
stream decryptor connected to a transmission channel for ATM cells at the receiver end, 
having a stream encryptor arranged in the transmission channel at the transmitter end, the 
stream encryptor and stream decryptor(s) each having a pseudo-random generator which 
generates a variable key stream which is identical at the transmitter and at the receiver ends 
with the aid of a secret key. 



[0002] In broadband ISDN, transmission takes place in asynchronous transfer mode (ATM), 
the information being packetized into packets of identical length, so-called "ATM cells", 
hereinafter also called "cells". A cell is composed of a five octet long header and an 48 octet 
long information field containing the payload. The header of the cell is primarily used for 
identifying the connection to which this cell belongs. This identification is referred to as 
Virtual Path Identifier (VPI) and Virtual Channel Identifier (VCI). This and other 
information occupy a total of 32 bits in the header and are protected by an eight-bit error- 
correcting code. 

[0003] This error-correcting code, also called HEC (Header Error Control), is able to detect 
up to three-bit errors and to correct one-bit errors and adjacent double errors. Besides error 
protection, the HEC is also used for cell boundary detection, which described, inter alia, in 
Sigmund: "ATM - Die Technik des Breitband-ISDN" [ATM - The Technology of 
Broadband ISDN], R.v. Decker Publishing House, 2 nd edition, 1994. 

[0004] A valid header is found if the check sequence computed from these 32 bits coincides 
with the check sequence which is transmitted in the HEC field. At that point, the 
synchronization at the receiver end latches. After 53 octets, a valid header is expected again. 
In order to not interrupt the cell boundary detection process and thus maintaining the ATM 
cell synchronization, a continuous cell stream is required. ATM cell boundary detection is a 
very rugged synchronization method. 

[0005] In stream encryptors and stream decryptors, a pseudo-random sequence generated by 
a cryptographically strong pseudo-random generator (PRG) is used as a variable key. 
Unencrypted data p(t) is modulo-2 added with variable key k(t), resulting in encrypted data 
c(t). The decryption is then carried out using the same variable key k(t). For generating in 
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each case the same variable key, the two pseudo-random generators need to be synchronized. 

f 0006] The use of stream encryptors and stream decryptors in an ATM network and their 
synchronization is described by Heister U., Killat U.: "Private and Authentic Communication 
in Passive Optical Networks", International Journal of Network Management, Volume 5, 
Number 2, March- April 1995. In this connection, it is proposed to transmit an initialization 
vector for synchronizing the stream decryptor. However, this requires additional 
transmission capacity. 

[0007] The object of the present invention is to specify a reliable method for synchronizing 
stream decryptors which does not require additional capacity and can be implemented with 
the smallest possible outlay. 

[0008] In the device according to the present invention, this object is achieved by allocating 
a state automaton to the stream encryptor and to the at least one stream decryptor, 
respectively, it being possible for the state automaton to be advanced from ATM cell to ATM 
cell, and the respective state, besides the secret key, being used for generating the variable 
key. 

[0009] In this context, provision can be made in a preferred embodiment for the state to be 
able to be fed to a device for generating a function as a function of the state and of the secret 
key, the device being designed for controlling the pseudo-random generator. 

[0010] The device according to the present invention can be used both between optical line 
terminations (OLT) and in the case of optical network terminations (ONT), in each case one 
OLT and one ONT being provided with a pseudo-random generator and a state automaton. 
When the system is initialized, all state automatons are set to the same initial state. Each 
ONT has a secret key. 

[0011] The device according to the present invention can, in principle, be already used in the 
case of a transmission between a transmitter and a receiver. However, a particularly 
advantageous further refinement consists in that, in the stream encryptor, the secret key of the 
destination of the specific transmitted ATM cell and the respective state are used for 
generating the variable key, and in that the state automatons of the stream encryptor and of 
the stream decryptors can be advanced independently of the destination of the specific ATM 
cell. In this context, each ONT (optical network termination) has a secret key, the OLT 
(optical line termination) has the secret keys of all ONTs. 
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[0012] The objective is achieved in the method according to the present invention in that the 
variable key depends, moreover, on the state of a state automaton which is allocated to the 
stream encryptor and to the at least one stream decryptor and which is advanced from ATM 
cell to ATM cell. In this context, provision is preferably made for the advance of the state 
automaton to be derived in response to the detection of a cell boundary by comparing a check 
sequence computed from the header to a check sequence which is also transmitted in the 
header of the cell. This does not involve any additional outlay because devices for cell 
boundary detection are needed in the receivers anyway. 

[0013] An advantageous embodiment of the method according to the present invention 
consists in that an input variable for the respective pseudo-random generator is generated 
from the secret key and the respective state with the aid of a predefined function. 

[0014] The method according to the present invention is particularly advantageous if several 
receivers which each have a stream decryptor are connected to the transmission channel, and, 
in this connection, headers of the ATM cells contain information on which receivers are the 
destinations of the ATM cells, because the secret key of the stream decryptor at the respective 
destination is taken as the basis for generating the variable key in the stream encryptor and 
because the state automatons allocated to the stream encryptor and to the stream decryptors 
are advanced in response to each transmitted ATM cell. 

[0015] Exemplary embodiments of the present invention are shown in the drawing on the 
basis of several Figures and explained in greater detail in the following description. 

[0016] Figure 1 shows a detail of an ATM network including a transmitter and two receivers; 
and Figure 2 shows a schematic representation of a method for cell boundary detection which 
is known per se. 

[0017] In Fig. 1, a transmitter 1, which forms part of an otherwise not shown OLT, transmits 
a stream of ATM cells via an optical network 2 to receivers in ONTs of which only two 
receivers 3, 4 are shown. Prior to transmission, the playload data of each cell is encrypted 
using a stream encryptor which is composed of an exclusive OR circuit 5 and a pseudo- 
random generator 6 which feeds in each case one variable key kl(t), k2(t) to exclusive OR 
circuit 5 so that playload data p(t) is fed to optical network 2 as encrypted data c(t). 
Connected in series to and before receivers 3 and 4 are stream decryptors 7, 1 1; 8, 12 for 
decryption to which the cell stream is fed via a device 9, 10 for detecting the cell boundaries, 
respectively, and in which in each case one pseudo-random generator 11,12 derives a 
variable key kl(t), k2(t) which is fed to in each case one exclusive OR circuit. The signal 
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derived by devices 9, 10 indicates the boundary of a cell and is also needed in receivers 3, 4 
for evaluating the header. 

[0018] A device for cell boundary detection is schematically shown in Fig. 2; 40 bits being 
tapped in each case from the cell stream supplied via 2 (in the Figure, one arrow represents 4 
bits). Via bits 9 through 40, a HEC is generated at 13 in the same manner as in the 
transmitter, the HEC being compared to the preceding bits 1 through 8 in an 8 -bit comparator 
14. In the case of equality, a signal is emitted at 15 which signifies the detection of a valid 
header. 

[0019] The stream encryptor and the stream decryptors are each allocated a state automaton 
16, 17, 18 which is advanced at the beginning of each cell. The then assumed specific state 
is fed in each case to a device 19, 20, 21 for computing function values from the state and a 
secret key. Device 19 is controlled by transmitter 1 in such a manner that a secret key kl or 
k2 is used, depending on the destination of the cell. Devices 20 and 21 at the receiver end 
each receive only one secret key kl or k2. 

[0020] Via the encryption with the key of the respective receiver and by advancing state 
automatons 16, 17, 18 in response to the transmission of each cell, always the correct variable 
key kl(t) or k2(t) is used at the respective receiver. The ATM cell boundary detection used 
for synchronization is a very rugged synchronization method which permits reliable 
decryption of the transmitted data, using the present invention. 



What is claimed is: 
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A device for synchronizing at least one stream decryptor connected to a transmission channel 
for ATM cells at the receiver end, having a stream encryptor arranged in the transmission 
channel at the transmitter end, the stream encryptor and the stream decryptor(s) each having a 
pseudo-random generator which generates a variable key which is identical at the transmitter 
and at the receiver ends with the aid of a secret key, 

wherein the stream encryptor and the at least one stream decryptor are each allocated 
a device for cell boundary detection and a state automaton, it being possible for the state 
automaton to be advanced by the device for cell boundary detection, and the respective state, 
besides the secret key, being used for generating the variable key. 

The device as recited in Claim 1, 

wherein the state can be fed to a device for generating a function as a function of the 
state and of the secret key, the device being designed for controlling the pseudo-random 
generator. 

The device as recited in one of the preceding Claims, several receivers which each have a 
stream decryptor being connected to the transmission channel, and headers of the ATM cells 
containing information on which receivers are the destinations of the ATM cells, 

wherein the secret key of the destination of the specific transmitted ATM cell and the 
respective state are used for generating the variable key in the stream encryptor, and the state 
automatons of the stream encryptor and of the stream decryptors can be advanced 
independently of the destination of the specific cell. 

A method for synchronizing at least one stream decryptor connected to a transmission 
channel for ATM cells at the receiver end, having a stream encryptor arranged in the 
transmission channel at the transmitter end, the stream encryptor and stream decryptor(s) each 
having a pseudo-random generator which generates a variable key which is identical at the 
transmitter and at the receiver ends with the aid of a secret key, 

wherein the variable key depends, moreover, on the state of a state automaton which 
is allocated to the stream encryptor and to the at least one stream decryptor and which is 
advanced from ATM cell to ATM cell. 

The method as recited in Claim 4, 

wherein the advance of the state automaton to be derived in response to the detection 
of a cell boundary by comparing a check sequence computed from the header to a check 
sequence which is also transmitted in the header of the cell. 
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The method as recited in Claim 4 or 5 ? 

wherein an input variable for the respective pseudo-random generator is generated 
from the secret key and the respective state with the aid of a predefined function. 

The method as recited in one of the Claims 4 through 6, several receivers which each have a 
stream decryptor being connected to the transmission channel, and headers of the ATM cells 
containing information on which receivers are the destinations of the ATM cells, 

wherein the secret key of the stream decryptor at the respective destination is taken as 
the basis for generating the variable key in the stream encryptor, and the state automatons 
allocated to the stream encryptor and to the stream decryptors are advanced in response to 
each transmitted ATM cell. 
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Abstract 

In a device and a method for synchronizing at least one stream decryptor connected to a 
transmission channel for ATM cells at the receiver end, having a stream encryptor arranged in 
the transmission channel at the transmitter end, the stream encryptor and stream decryptor(s) 
each having a pseudo-random generator which generates a variable key which is identical at 
the transmitter and at the receiver ends with the aid of a secret key, the stream encryptor and 
the at least one stream decryptor are each allocated a device for cell boundary detection and a 
state automaton, it being possible for the state automaton to be advanced by the device for 
cell boundary detection, and the respective state, besides the secret key, being used for 
generating the variable key. 
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